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ANALYSIS  OF  DISASTER  PLANNING 
IN  BUSINESS  AND  INDUSTRY 

by 

Donald  B.  Hoffmann 
Commander,  Supply  Corps,  U.S.  Navy 

ABSTRACT 

Natural  and  man-made  disasters  ranging  from  minor  disturbances 
to  major  catastrophic  events  will  continue  to  plague  U.S.  business 
and  industry  in  the  future.  The  economic  costs  and  loss  of  human 
lives  will  remain  unacceptably  high  without  corrective  actions  on 
the  part  of  both  government,  and  business  and  industry.  Corporate 
losses  each  year  are  staggering  --  vastly  reducing  the  U.S.  gross 
domestic  product,  and  certainly  weakening  this  nation's  adsility  to 
pursue  its  stated  national  interests.  The  February  1993  bomb  blast 
which  ripped  through  New  York  City's  World  Trade  Center  caused  over 
one  billion  dollars  in  property  damage  and  lost  profits.  Thus,  any 
serious  efforts  to  ensure  the  uninterrupted  operation  of  American 
business  and  industry  xn  the  event  of  a  disaster  would  appear  to  be 
of  paramount  importance.  Government  leaders,  as  well  as  business 
and  industry  executives,  share  a  responsibility  in  disaster 
planning  and  preparedness. 
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Business  and  industry  of  all  sizes  are  susceptible  to  damage 
or  destruction  from  natural  disasters  and  man-made  catastrophes. 
Newspapers  describe  daily  the  loss  of  life,  suffering,  and  costly 
damages  caused  by  tornadoes,  hurricanes,  earthquakes,  fires, 
chemical  spills,  and  so  on.  Media  coverage  of  these  events  has 
brought  significant  pressure  upon  federal,  state,  and  local 
authorities  to  plan  for  disasters,  and  respond  quickly  and 
decisively.  This  is  particularly  true  in  regard  to  relieving  human 
suffering,  as  was  the  case  with  the  August  1992  Hurricane  Andrew 
disaster  and  sxabsecjuent  massive  response  effort  in  Florida. 

But  what  about  U.S.  business  and  industry?  Are  they  prepared 
for  disasters?  Should  they  plan?  What  is  business  resumption 
planning?  What  can  they  do  to  be  ready?  Is  insurance  enough? 
What  are  the  risks,  the  costs,  and  what  should  government  do  to 
assist? 

I  will  address  these  questions  in  this  paper.  Further,  I  will 
make  recommendations  in  regard  to  U.S.  policies,  and  suggest 
changes  for  business  and  industry  to  adopt  in  regard  to  disaster 
planning . 

THE  CONNECTION  WITH  NATIONAL  SECURITY 

In  the  interest  of  national  security,  business  and  industry 
personnel  and  dollar  losses  negatively  impact  the  U.S.  national 
economy;  in  some  cases  quite  severely.  The  Commerce  Dej ^rtment 
reported  that  due  to  the  effects  of  1992 's  Hurricane  Andrew 


(Southeastern  U.S.)  and  Iniki  (Hawaii),  the  nation's  corporate 
profits  were  down  by  45  billion  dollars  and  personal  income  was 
reduced  by  10  billion  dollars  at  an  annual  rate  in  the  third 
quarter  of  1992.’  Farm  income  was  reduced  by  7.3  billion  dollars 
alone  in  August  1992  at  an  annual  rate.*  Coupled  with  other 
natural  and  man-made  disasters  which  occurred  in  1992,  the  dollar 
losses  to  U.S.  business  and  industry  ran  into  the  hundreds  of 
billions  of  dollars. 

Corporate  losses  each  year  are  staggering  -  -  vastly  reducing 
the  U.S.  gross  domestic  product,  and  certainly  weakening  this 
nation's  cUaility  to  pursue  its  stated  national  interests.  In  fact, 
the  January  1993  National  Security  Strategy  of  the  United  States 
released  by  the  White  House,  states  "National  prosperity  and 
national  security  are  mutually- supportive  goals,"  and  "A  top 
national  security  priority  today  must  be  to  strengthen  economic 
performance  at  home."  Thus,  any  significant  effort  to  help  ensure 
uninterrupted  operation  of  American  business  and  industry  in  a 
disaster- stricken  area  appears  to  be  of  paramount  importance. 

In  more  detail,  natural  and  man-made  disasters  increase  the 
U.S.  trade  imbalance,  slow  economic  growth,  decrease  the  savings 
rate,  reduce  national  productivity,  raise  unemployment  and  so  on. 
Additionally,  our  most  precious  national  resource  --  people,  are 
often  injured  or  killed.  Should  we  not  protect  our  work  force  as 
we  would  valuable  natural  assets  and  capital? 

As  the  U.S.  reduces  the  size  of  its  military,  the  importance 
of  its  ability  to  rapidly  and  effectively  mobilize  greatly 
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Increases.  It  is  easy  to  see  that  corporate  losses  and  actual 
destruction  of  some  firms,  possibly  including  strategic  industries, 
seriously  impairs  our  ability  to  mobilize  and  reconstitute. 

The  U.S.  can  ill  afford  the  tremendous  losses  to  business  and 
industry  suffered  each  year.  The  billions  spent  by  the  government 
in  emergency  relief  are  overwhelming  enough  --  adding  more  fuel  to 
the  U.S.  budget  deficit  and  national  debt. 


WHAT  ARE  THE  RISKS 

On  Monday,  13  April  1992,  several  downtown  Chicago 
businesses  reported  flooding  in  their  buildings. 

The  flooding,  caused  by  construction  work  near  a 
power,  phone,  and  television  cable  tunnel  adjacent 
to  a  river,  progressed  to  the  point  where  200 
buildings  were  without  power,  250,000  people  had  to 
be  released  from  work,  and  21  square  blocks  were 
affected.  Estimates  ran  to  40  million  dollars  per 
day  in  lost  productivity,  with  a  possible  cost 
impact  of  1.5  billion  dollars.  Electrical  power 
outages  plagued  many  of  the  businesses  for  days,  and 
recovery  operations  did  not  go  smoothly  for  all  firms.* 

The  vulnerability  of  our  nation's  businesses  and  industry  to 
natural  and  man-made  disasters  has  risen  with  our  growing  economic 
expansion  and  corresponding  corporate  complexity  and  automation. 
Most  businesses  today  of  any  size  depend  on  high  technology  systems 
for  the  flow  of  vital  information;  without  communications  or 
computers,  most  businesses  would  cease  to  operate. 

Statistics  show  that  between  four  and  one  half  to  five  and  one 
half  days  after  a  data  processing  disaster  which  is  not  corrected, 
company  efficiency  drops  to  50  percent,  and  by  the  llth  day  to  only 
nine  percent.*  And  according  to  the  National  Fire  Protection 


Agency,  after  a  fire,  43  percent  of  all  businesses  never  reopen, 
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while  29  percent  close  within  three  years  of  the  fire.*  These 
statistics  paint  a  dismal  picture  for  firms  which  have  or  may 
experience  various  disasters. 

An  effective  risk  management  program  is  one  important  method 
for  a  company's  leadership  to  manage  risks  by  either  eliminating, 
reducing,  accepting,  or  transferring  them.  Risk  management  is 
already  a  normal  function  of  most  large  companies,  and  an  integral 
task  in  the  disaster  planning  process.  Three  essential  elements  of 
risk  management  are  described  below. ‘ 

First,  firms  must  identify  the  nature  of  the  risks  involved. 
This  paper  is  concerned  with  two  types  of  risks  -  -  natural  and  man¬ 
made  or  technological  disasters. 

In  regard  to  natural  disasters,  businesses  must  analyze  which 
natural  hazards  pose  threats,  and  to  what  degree.  The  size  of  a 
company,  its  facilities,  the  geographic  location,  and  the  season  of 
the  year  are  just  a  few  of  the  factors  to  consider.  For  instance, 
floods  may  be  a  specific  interest  if  a  company  rests  in  a  flood 
plain,  or  earthquakes  may  be  of  primary  concern  if  a  firm  is 
located  in  Los  Angeles.  In  any  case,  other  natural  risks  include 
storms,  tornadoes,  dcca  failures,  hurricanes,  heavy  snow  and  ice, 
tsunamis,  fires,  volcanoes,  etc.  Local  (city  and  county)  and  state 
emergency  planning  offices  are  good  sources  of  information  in 
identifying  these  risks. 

Natural  disasters  threaten  all  parts  of  the  U.S.,  so  no 
business  or  industry  is  immune.  The  fact  that  more  and  more 
people,  including  businesses,  are  concentrating  in  urban  zones 
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today  makes  them  even  more  susceptible  to  disaster,  while  natural 
threats  can  be  predictable,  more  often  than  not  they  are 
unpredictcUole .  One  new  natural  threat  recently  recognized  is  the 
urban  wildfire.  In  October,  1991,  a  wildfire  swept  over  1,800 
acres  in  the  hills  of  Oakland  and  Berkeley,  California  killing  24 
people  and  resulting  in  almost  2  billion  dollars  in  financial 
losses 

Man-made  or  technological  risks  are  another  risk  management 
planning  worry.  They  include,  but  are  not  limited  to,  hazardous 
material  spills,  nuclear  accidents,  weapons  incidents,  civil 
disturbances,  sabotage,  computer  hacking,  terrorism,  intrusion, 
transportation  accidents,  bombings,  chemical  spills,  structural 
fires,  power  outages,  public  demonstrations,  and  so  on. 

Man-made  threats  are  a  consideradsle  risk  to  companies,  but 
also  may  affect  the  public  at  large.  Chemical  spills,  for 
instance,  pose  a  direct  threat  to  people  and  property  if  they  take 
place  on  a  road  near  a  populated  area.  Company  executives  could  be 
subject  to  both  criminal  and  civil  penalties  today  for  injuries, 
death,  and  property  damage  caused  by  their  negligence  or  breach  of 
safety.  The  fact  that  technological  innovations  will  continue 
poses  a  real  challenge  to  our  nation's  businesses  and  industry. 

The  second  step  of  risk  management  is  determining  the  probable 
consequences  of  a  disaster.  Risk  managers  often  conduct  risk 
surveys  to  determine  the  extent  of  assets  needing  protection. 
Depending  on  the  size  and  type  of  enterprise,  losses  or  damage 
could  pertain  to  hard  copy  documents,  data  files,  libraries. 


software,  hardware,  furniture,  equipment,  and  facilities.  The  vast 
majority  of  financial  firms  would  obviously  be  concerned  with  their 
data  centers  for  instance,  where  smaller  businesses  may  be  mainly 
interested  in  the  consequences  of  the  loss  or  damage  to  their 
facilities. 

The  third  and  final  element  of  risk  management  is  assessing 
the  potential  financial  impact  of  a  disaster  on  a  company.  Once 
the  risks  are  identified  and  assessed,  potential  financial  loses 
can  be  estimated  and  equated  to  a  dollar  figure.  For  instance,  a 
telephone  sales  firm  or  catalog  sales  operation  which  relies  on  the 
public  phone  networks,  may  equate  a  one  hour  phone  outage  with 
50,000  dollars  in  lost  sales.  This  example  is  not  farfetched.  A 
1988  fire  at  a  telephone  h\ib  station  in  Hinsdale,  Illinois  severely 
affected  businesses  throughout  the  nation.  Incoming  calls  and 
toll-free  services  were  knocked  out  for  Transworld  Delivery,  Sears, 
and  other  large  businesses.  One  distributor,  for  example,  lost  its 
incoming  calls  for  two  weeks  which  had  previously  averaged  5,000 
calls  per  day.*  A  detailed  economic  risk  assessment  may  thus 
convince  a  firm  to  increase  its  insurance,  procure  a  backup  power 
supply,  or  obtain  diverse  telephone  routing  for  their  calls,  for 
example . 

Severe  disasters,  such  as  the  California  Loma  Prieta 
earthquake  of  October  1989,  or  South  Carolina's  Hurricane  Hugo  of 
September  1989,  demonstrate  the  complexity,  and  illustrate  the 
financial  relationships  among  con^anies.  Each  of  the  two  states 
lost  tourism  dollars  because  of  the  disasters,  as  did  the  airlines. 
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Huge  eunounts  of  timber  were  lost  in  South  Carolina  and 
significantly  affected  the  regional  construction  industry.  The 
various  insurance  industry  headquarters  located  throughout  the 
nation  which  underwrote  the  individual  and  business  losses, 
suffered  their  own  financial  losses. 

The  importance  of  risk  management  assessment,  and  its  ultimate 
objective,  is  the  firm's  survival.’  Once  the  assessment  of  the 
risk  is  complete,  company  management  must  then  decide  whether  to 
develop  a  disaster  recovery  plan,  dust  off  an  existing  plan,  or 
decide  the  costs  are  too  high  and  the  risks  too  low,  and  do 
nothing . 

WHY  COMPANIES  PLAN 

"It  takes  years  to  build  a  business... 

...But  only  minutes  to  destroy  it."*® 

U.S.  business  and  industry  are  at  risk  from  a  broad  spectrum 
of  potential  disasters.  The  largest  category  of  threats  are 
natural;  however,  man-made  or  technological  disasters  may  pose  an 
even  more  serious  risk.  Managers  cannot  always  prevent  disasters 
from  occurring  so  they  must  be  prepared  to  manage  them  properly. 

No  matter  what  the  threat,  planning  can  save  lives,  minimize 
or  prevent  losses,  and  may  ultimately  assure  survival  of  a 
business.  Then  why,  in  a  1989  survey  conducted  by  Contingency 
Planning  Research,  Inc.,  a  firm  that  specializes  in  disaster 
recovery  consulting  and  services,  was  it  shown  that  of  1,500 
businesses  surveyed,  61  percent  had  disaster  recovery  plans 


covering  only  their  data  centers,  and  only  12  percent  had  total 
organization  recovery  plans?" 

Planning  is  an  essential  part  of  managing  any  business. 
Companies,  both  large  and  small,  plan  to  some  degree.  Those  with 
an  actual  "business  plan"  and  conpany  strategy  are  today  beginning 
to  recognize  the  inportance  of  preparing  a  comprehensive  disaster 
recovery  plan.  In  the  early  1980s,  most  companies  had  security  and 
safety  programs  in  effect,  and  recognized  the  value  of  performing 
risk  management  studies  or  vulnerability  assessments.  However, 
those  that  did  have  disaster  plans,  usually  only  had  some  sort  of 
data  processing  backup  scheme,  en^loyee  evacuation  plan,  or  some 
other  limited  scope  plan.  Only  recently  have  consultants, 
managers,  and  executives  started  to  realize  and  stress  the 
importance  of  total  organization  recovery  plans. 

There  may  be  no  one  good  reason  for  business  and  industry  to 
do  disaster  planning.  All  firms  operate  differently;  however,  some 
combination  of  the  following  reasons  to  plan  may  provide  the 
answer : 

o  A  risk  management  assessment  indicates  a  disaster 
recovery  plan  is  essential. 

o  The  location  of  the  conpany  is  in  a  high  risk  area, 
i.e.,  situated  on  a  fault  line  or  in  a  flood  plain, 
for  exanple. 

o  The  business  deals  with  hazardous  materials, 
chemicals,  or  nuclear  substances  where  the  threat 


of  a  disaster  is  high,  amd  a  threat  exists  to  the 
general  pxiblic,  as  well  as  employees, 
o  A  firm  is  dependent  on  critical  resources  or 
services  of  companies  located  in  high  risk  areas 
or  enterprises. 

o  Environmental  daunage  may  result  in  the  case  of 
an  accident. 

o  A  risk  management  assessment  could  save  lives 
and  safeguard  company  assets, 
o  Disaster  planning  may  assist  in  limiting 
financial  losses. 

o  Businesses  and  industries  with  risk  management 
assessments  reduce  reaction  time  and  inprove 
coordination. 

o  A  company  or  industry  experienced  a  disaster 
firsthand  in  the  past  which  resulted  in 
low  credibility,  i.e.,  the  Bhopal  disaster, 
may  require  a  risk  management  assessment  to 
improve  credibility. 

o  Planning  can  prevent  an  interruption  of 
product  delivery  or  services  to  customers, 
primarily  to  prevent  losing  market  share,  and 
preventing  losses  to  shareholders, 
o  Businesses  operate  better  if  a  share  of 
the  profits  are  put  back  into  improving  the 
firm. 
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o  A  crisis  situation  is  no  time  for  planning, 
o  Planning  and  preparedness  are  moral  and 
ethical  responsibilities, 
o  There  is  a  con^any  expectation  that  if 
caught  unprepared,  the  corporation  and  exec¬ 
utives  will  be  penalized  heavily, 
o  A  vital  part  of  a  con^any's  business  strategy 
is  the  planning  and  preparedness  for  risks, 
o  It  is  more  advantageous  to  voluntarily  plan, 
before  the  government  in^oses  regulations, 
o  Risk  management  is  a  short  term  cost  which 
may  pay  a  long  term  benefit, 
o  Senior  company  management  is  committed  to 
disaster  planning,  and  view  planning  and 
preparedness  as  obvious  responsibilities, 
o  Risk  management  helps  the  company  maintain 
a  competitive  advantage. 

o  Vital  con^any  data  and  history  files  may 
be  lost  forever  if  there  are  no  contingency 
plans . 

o  Automated  firms  which  cannot  go  back  to 
manual  operation,  owe  it  to  the  firm's 
success  to  be  prepared  for  risks, 
o  Preparedness  may  be  contractually  required, 
particularly  when  associated  with  the  govern¬ 


ment. 


o  Planning  guarantees  continued  employment 
for  en^loyees. 

o  A  plan  for  disaster  preparedness  may  offset 
the  rising  cost  of  insurance  coverage, 
o  A  company's  auditors  or  consultants  often 
recommend  planning  and  preparedness  for 
disasters. 

o  Industry  periodicals  endorse  disaster 
planning . 

The  list  of  why  businesses  and  industry  should  do  disaster 
recovery  planning  is  almost  endless.  Perhaps  it  is  sirrqply  just 
that  "An  ounce  of  prevention  is  worth  a  pound  of  cure . "  The 
statistics  presented  earlier  in  this  paper  speak  for  themselves, 
and  generally  paint  a  pretty  dismal  picture  of  survival  for  firms 
not  taking  precautions. 

BUSINESSES  AND  INDUSTRIES  THAT  PLAN 

Finally,  the  question  may  be  asked,  "What  businesses  do 
disaster  planning?"  The  answer  may  be  that  in  general,  most  large 
companies  do  limited  disaster  recovery  or  business  resumption 
planning.  Almost  all  firms  which  rely  on  automated  systems  and 
computers  have  a  plan,  although  it  may  be  outdated. 

Depository  institutions,  colleges  and  universities,  hotels  and 


motels,  hospitals,  and  chemical  conpanies  are  considered  by  the 
Institute  for  Crisis  Management  to  be  the  top  five  crisis  prone 
U.S.  industries.  And,  the  fastest  growing  crisis  categories 


(threats  to  business  and  industry)  in  the  years  1989  and  1990  were 
crime,  government  intervention,  management  scandals,  and  legal  and 
financial  crises.'^ 

Public  utilities  have  been  in  the  forefront  of  disaster 
planning  and  maintaining  operations  during  emergencies  for  years. 
However,  businesses  and  industry  cannot,  and  should  not,  rely  on 
the  generally  good  past  records  of  public  utility's  services  if 
those  services  are  vital  to  a  con5)any's  survival.  For  e:  e,  the 

1992  Chicago  flood  which  caused  lengthy  power  outages,  ana  che  1988 
Illinois  Bell  Switching  Station  fire  which  caused  nation-wide 
communications  interruptions,  are  prime  exanples  of  the  failure  of 
public  utilities  to  keep  your  business  operating  smoothly. 

In  contrast,  the  Pacific  Gas  and  Electric  Company  of 
California  performed  admireibly  in  the  aftermath  of  the  1989  Loma 
Prieta  earthquake.  Just  a  few  months  prior  to  the  earthquake,  the 
utility  had  staged  an  emergency  response  drill  based  on  a 
hypothetical  7.0  magnitude  earthquake  near  San  Francisco.'*  The 
company  and  emergency  workers  were  therefore  sufficiently  prepared 
to  deal  with  the  actual  quake.  On  the  East  Coast,  Baltimore  Gas 
and  Electric  Con^any  tested  its  plan  in  1985  during  two 
kidnapping/hostage  incidents,  and  during  a  major  labor  dispute.'* 
The  company  was  obviously  farsighted  enough  to  have  developed  a 
conqprehenslve  plan  addressing  significantly  more  contingencies  than 
just  the  traditional  issue  of  responding  to  the  interruption  of 
utility  service  to  customers. 

In  regard  to  financial  institutions,  particularly  banks,  most 


have  some  type  of  disaster  recovery  plan,  but  many  of  these  may  not 
have  been  regularly  updated  or  tested.  Federal  regulations  for 
banks  simply  mandate  that  plans  be  developed  and  reviewed  annually. 
On  the  other  hand,  lightly  regulated  industries  have  typically 
operated  under  the  assinnption  that  disasters  will  not  strike  or 
that  insurance  solves  any  problems  that  arise.*® 

Finally,  the  Institute  for  Crisis  Management  determined  in  a 
1991  business  executive  survey  that  while  76  percent  of  them 
believe  that  crises  are  inevitable,  76  percent  have  no  formal 
plans.  And,  72  percent  of  the  executives  do  not  have  a  crisis 
management  team  in  their  organization,  57  percent  are  not  satisfied 
with  their  company's  crisis  response  capabilities,  and  73  percent 
provide  no  crisis  response  training.”  The  notion  that  business 
executives  believe  a  crisis  or  disaster  will  occur,  yet  prepare 
inadequately,  is  a  real  paradox.  The  next  section  of  this  paper 
may  present  some  insight  into  why  businesses  inadequately  plan,  or 
fail  to  plan  for  disasters. 

WHY  MANAGEMEMT  IGNORES  DISASTER  PLAMNING 

Not  all  businesses  and  industries  develop  disaster  plans,  even 
though  their  management  recognizes  that  disasters  can  and  will 
occur.  Planning  is  normally  undertaken  to  avoid  risk  and 
uncertainty,  but  no  amount  of  planning  and  precautions  can  reduce 
risk  to  zero. 

Management  can  be  defined  as  the  art  of  handling  or  directing 
to  achieve  a  purpose,  which  includes  the  basic  functions  of 
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planning,  organizing,  leading,  and  controlling.**  However,  many 
managers  disregard  or  simply  overlook  disaster  planning  as  a  key 
element  to  their  overall  planning  efforts,  and  possibly  to  their 
survival . 

New  enterprises  may  legitimately  lack  the  financial  and 
personnel  resources  to  do  an  adequate  job  of  disaster  planning; 
everyday  business  operations  are  often  overwhelming  in  and  of 
themselves.  And  then,  no  one  individual  has  all  of  the  knowledge 
and  expertise  needed  to  develop  a  vied)le  plan.”  It  often  takes 
team  work,  and  possibly  outside  assistance  cuid  research.  On  the 
other  hand,  some  businessmen  singly  keep  their  problems  a  secret 
because  they  anticipate  excessive  costs  in  hiring  a  consultant  or 
outside  help  to  straighten  things  out.“ 

In  larger  businesses  and  industries,  policy  makers  may  view 
other  business  problems  as  more  important,  company  advocates  for 
disaster  preparedness  may  not  have  the  political  force  to  be  heard, 
and  costs  may  seem  disproportionate  to  the  benefits.^'  Further, 
top  management  may  singly  not  be  committed  to  a  serious  planning 
effort,  or  recognize  the  personal  financial  liability,  including 
civil  and  criminal  penalties,  that  executives  may  face  in  a 
disaster  today. 

Management  can  also  place  an  overreliance  on  basic  insurance 
or  business  interruption  insurance,  which  will  be  discussed  in  more 
detail  later.  They  may  also  be  content  to  rely  solely  on  the 
assistance  of  local  (city  and  county) ,  state,  or  federal  agencies 
without  adequate  investigation  of  the  help  actually  available  once 


a  disaster  strikes.  The  Federal  Emergency  Management  Agency  (FEMA) 
and  the  Small  Business  Administration  (SBA)  may  not  be 
particularly  helpful,  or  at  least,  not  respond  quickly  enough; 
certainly  they  are  not  suitcible  substitutes  for  con5)rehensive 
disaster  plans.  Disasters  can  also  be  viewed  as  just  another 
crisis  which  will  be  handled  as  are  other  "fires"  when  they  occur. 

Human  factors  working  against  the  management  chore  of  planning 
include  the  tendency  to  procrastinate  indefinitely,  and  an 
inability  to  predict  the  future  due  to  uncertainty,  hesitancy  to  be 
creative,  and  a  lack  of  experience  with  a  serious  disaster  which 
might  trigger  some  urgency.  Planning  can  be  thought  of  as  a 
"straight jacket "  which  limits  flexibility,  too.“ 

From  a  larger  strategic  perspective,  management  may  not  think 
of  disaster  planning  in  terms  beyond  a  set  of  guidelines  for 
limiting  negative  exposure  in  the  media,  or  a  sinple  recall  list  of 
phone  numbers.”  Disaster  planning  is  also  often  not  considered 
important  enough  to  be  included  in  the  company's  overall  "business 
plan . "  One  other  ina j  or  reason  is  that  no  government  agency  or  laws 
mandate  that  most  businesses  and  industries  prepare  disaster  plans. 

Unfortunately,  executives  may  not  feel  morally  or  ethically 
bound  to  plan  for  the  survival  of  their  firm,  either.  They  may 
disregard  the  safety  of  employees  or  the  environment.  And, 
management  may  not  feel  a  responsibility  to  its  customers  by 
planning  to  survive  or  continue  business  operations  uninterrupted. 

Many  firms  today  rely  heavily  upon  contractors  which  handle 
their  operations.  For  instance,  many  companies  place  almost  total 
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reliance  on  maintenance  contractors,  hazardous  material  disposal 
and  transport  firms,  and  public  utility  workers  as  previously 
discussed,  for  crisis  prevention  or  disaster  recovery  actions. 
Firms  may  also  feel  contractors,  rightly  or  wrongly,  are 
responsible  for  their  firm's  safety  and  training. 

One  of  the  supposed  success  stories  of  the  17  October  1989  San 
Francisco  Bay  Area  earthquake  involved  Safeway  grocery  stores. 
Many  of  the  Safeway  stores  were  reported  to  have  returned  to 
nozmalcy  without  elaborate  plans;  singly  relying  on  the  good 
judgment  of  its  local  managers.  However,  140  of  the  company's  240 
stores  suffered  damage,  with  30  stores  closing,  and  many  others 
losing  electrical  power  for  days,  which  was  particularly 
detrimental  to  needed  refrigeration  in  the  stores.  Vital  services 
were  restored  to  the  public,  such  as  providing  water  and  food,  in 
48  hours  in  only  some  cases."  Khat  might  have  happened  if  Safeway 
had  a  vicdDle,  con^rehensive  disaster  plan  for  the  stores  in  the 
earthquake -prone  San  Francisco  region?  Would  more  stores  have 
remained  open  and  backup  power  been  available? 

THE  ROLE  OF  GOVERMMEMT 

In  contrast  to  many  other  nations,  the  U.S.  is  relatively 
decentralized.  Today  there  are  over  82,000  separate  forms  of 
government  at  the  local  level  spread  throughout  the  U.S.  This 
decentralization  promotes  a  lack  of  standardization,  and  inhibits 
to  a  great  degree,  the  function  of  federal  leadership.^  This  is 
truly  the  case  in  regard  to  disaster  planning  for  businesses. 
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In  cities,  the  city  manager,  emergency  preparedness 
coordinator,  or  the  fire  chief  have  emergency  response  leadership 
roles.  Counties  have  full-time  emergency  preparedness  coordinators 
44.3  percent  of  the  time,  or  part-time  coordinators  33.3  percent  of 
the  time.”  All  states  and  territories  of  the  U.S.  have  emergency 
preparedness  organizations;  however,  they  vary  in  size  and 
capedjility.  California,  for  exanple,  has  a  very  large  state 
emergency  organization,  while  the  Virgin  Islands  had  only  one 
emergency  planner  and  no  funded  training  at  the  time  Hurricane  Hugo 
struck  in  1989.*^ 

Local  and  state  governments  have  primary  responsibility  for 
disaster  preparedness,  while  the  Federal  Emergency  Management 
Agency  (FEMA)  provides  guidance  for  plans,  training,  and  exercises, 
including  funding  planning  and  training.  State  participation  is 
voluntary,  and  FEMA  has  no  means  to  ensure  state  preparedness.” 

At  the  present  time,  FEMA,  state,  and  local  government  efforts 
are  aimed  primarily  at  disaster  preparedness,  response  and 
recovery,  as  they  relate  to  government  activities,  communities,  and 
individuals.  Guidance,  for  cooperation  with  and  assistance  to 
business  and  industry,  is  virtually  nonexistent.  Although  there 
are  beginning  to  be  more  efforts  at  cooperation  with  business  and 
industry  at  the  city  and  county  level,  there  is  almost  a  vacuum  at 
FEMA.  FEMA  does  not,  and  has  not,  set  policy  in  regard  to  disaster 
planning  for  American  business. 

FEMA  has  pxiblished  the  following  two  handbooks  for  business 


and  industry: 


o  Disaster  Planning  Guide  for  Business  and  Industry.  FEMA 
141/August  1987 

o  Disaster  Mitigation  Guide  for  Business  and  Industry.  FEMA 
190/February  1990 

Although  useful  guides  for  firms  interested  in  disaster 
planning  issues,  their  distribution  is  primarily  to  state  and  local 
emergency  preparedness  offices,  so  their  availadsility  (or  known 
existence)  to  business  and  industry  is  questionable. 

FEMA's  Emergency  Management  Institute  which  offers  numerous 
training  courses,  offers  none  designed  specifically  for  business 
and  industry.  States  had  also  been  fimded  in  the  past  to  conduct 
business  and  industry  conferences,  but  agendas  were  never  set,  and 
there  have  been  no  conferences  in  the  recent  past. 

FEMA  has  placed  relatively  minor  enphasis  on  its  role  or 
responsibility  toward  business  and  industry,  providing  little 
funding  to  that  area.  FEMA  did  take  a  recent  step  in  the  right 
direction  when  it  commissioned  the  firm  of  Ogilvy,  Adams,  and 
Rinehard  to  conduct  a  "Business  and  Industry  Public  Awareness 
Materials  Needs  Assessment.”  The  report  was  published  in  October 
1991.  The  next  step  will  be  to  see  if  FEMA's  senior  leadership 
will  act  on  the  report's  recommendations.  Further,  FEMA  has  been 
undergoing  another  reorganization,  and  it  will  be  interesting  to 
see  how  the  new  Clinton  Administration  views  FEMA. 

Other  federal  level  players  in  the  business  and  industry  arena 
include  the  Small  Business  Administration  (SBA) ,  Environmental 


Protection  Agency  (EPA) ,  and  Occupational  Safety  and  Health 
Administration  (OSHA) . 

The  SBA's  disaster  role  is  primarily  concerned  with  providing 
small  business  recovery  loans  to  businesses  which  have  been 
involved  in  a  federally  declared  disaster.  Funds  are  provided  as 
required,  demand  based,  from  Congress.  The  revolving  fund 
previously  in  existence  was  eliminated  during  Office  of  Management 
and  Budget  (0MB)  Director  David  Stockman's  tenure  in  office.”  In 
fact.  President  Reagan  would  have  con^jletely  eliminated  the  SBA 
during  his  term  in  office  if  Congress  had  not  intervened.” 

There  are  an  estimated  14.4  million  businesses  in  this 
country,  of  which,  3.4  million  are  farmers,  and  11  million  are 
nonfarm  businesses.  Of  the  nonfarm  businesses,  10.8  million  (8.2 
percent)  are  considered  small,  and  approximately  99  percent  of  the 
farms  are  considered  small  by  the  agency's  size  standards.”  The 
SBA  provides  assistance  and  publishes  information  for  many  small 
businesses,  however,  disaster  planning  guidance  gets  short  shrift. 
The  SBA  does  not  develop  policy  in  regard  to  disaster  planning  or 
business  resumption  planning. 

OSHA  and  EPA  regularly  enforce  regulations  on  business  and 
industry  regarding  safety  and  preparedness.  And  OSHA  and  EPA  level 
fines  at  violators.  They  again  do  not  establish  disaster  recovery 
planning  policy.  But  in  one  recent  isolated  incident,  OSHA 
proposed  a  new  Process  Safety  Management  (PSM)  standard  designed  to 
prevent  catastrophes  or  minimize  the  consequences  of  accidents  in 
industries  that  use  hazardous  chemicals;  the  standard  includes 


mandatory  emergency  plan  development.” 

The  Department  of  Commerce,  Social  Security  Administration, 
Health  and  Hiiman  Services  Department,  Department  of  Transportation, 
and  countless  other  departments  and  agencies  of  the  federal 
government  play  some  limited  roles,  directly  or  indirectly,  related 
to  disasters.  Their  actions  are  not  guided  by  a  stated  U.S.  policy 
either,  though,  as  previously  mentioned. 

In  summary,  no  one  department  or  agency  sets  disaster  related 
planning  policy  for  the  federal  government.  In  fact,  it  is 
virtually  nonexistent.  The  ixt^ortsmce  of  disaster  planning  for 
business  and  industry  is  not  recognized  as  a  serious  issue  or 
perceived  as  cui  immediate  problem  despite  the  staggering  costs  to 
the  U.S.  economy  and  its  effect  on  national  security.  States  emd 
local  governments  have  been  relegated  the  task  of  dealing  with 
business  and  industry,  but  again,  the  system  is  haphazard  and 
occurs  only  in  isolated  incidents.  When  business  and  industry  do 
cooperate  with  state  and  local  government,  the  results  are  usually 
mutually  beneficial.  Various  federal  cuid  state  government  agencies 
are  beginning  to  individually  tighten  fincuicial,  safety,  and 
environmental  regulations  though,  primarily  due  to  a  lack  of 
planning  by  business  and  industry. 

JS-  ■XITSURAWCE.Mqggq? 

One  result  of  an  effective  risk  management  program  is  the 
determination  of  whether  or  not  insuremce  protection  for  the  firm 
is  necessary,  and  if  so,  how  much.  The  decision  to  insure  is  also 


an  essential  element  of  a  comprehensive  disaster  recovery  plan  and 
a  sensible  business  plan.  There  just  may  be  no  sufficient 
prevention  or  protection  technology  availeOale,  or  the  costs  may  be 
too  high.”  When  either  security  or  a  disaster  recovery  plan  are 
not  adequate  solutions  alone,  then  insurance  may  be  the  answer. 

Business  interruption  insurance  and  extra- expense  insurance 
may  be  the  way  to  address  certain  risks.  Business  interruption 
insurance  covers  ongoing  expenses  and  lost  profits  when  a  company's 
normal  operations  are  disrupted  by  the  damage  or  loss  of  insured 
property,  including  computer  systems.  Extra-expense  coverage 
provides  for  unanticipated  expenses  which  occur  during  recovery 
from  a  disaster.”  Expenses  such  as  tcuces,  wages,  utilities,  and 
so  on  continue  to  accrue  during  the  recovery  phase.  Business 
interruption  and  extra- expense  insurance  may  be  a  cost  effective 
solution. 

A  college  student  from  Cornell  University  in  Ithaca,  New  York, 
loaded  a  program  on  his  computer  in  November  1908  which  introduced 
a  "computer  tapeworm"  into  the  communications  network  which  linked 
colleges  and  universities  across  the  U.S.  His  program  shut  down 
6,000  computers  and  resulted  in  millions  of  dollars  of  lost 
computer  time.”  How  do  coxr^janies  protect  themselves  from  such 
destructive  programs  and  con^juter  viruses?  What  about  other  new  or 
unusual  threats?  Each  business  and  industry  has  unique  types  of 
operations  and  associated  risks.  Companies  have  to  carefully 
review  their  policy  and  work  with  their  insurer  to  get  the  most 
cost  effective,  comprehensive  policy  available.  In  regard  to 


viruses,  at  least  until  1989,  no  losses  had  been  submitted  to 
underwriters  as  a  claim." 

The  growing  awareness  of  the  environment  and  the  trend  toward 
protecting  it,  lead  to  the  issuing  of  policies  for  man-made 
disasters  in  the  recent  past.  However,  the  insurance  is  extremely 
expensive.  The  December  1984  Bhopal,  India  tragedy  (a  Union 
Carbide  plant  released  a  poisonous  gas,  killing  over  2,000  people)  , 
in  particular,  caused  "pollution  liedsility"  insurance  for  firms 
handling  hazardous  materials  and  wastes  to  increase  as  much  as  500 
percent . ” 

Other  more  standard  types  of  insurcince  may  be  the  answer  to  a 
firm's  needs  also.  They  include:  liability  insurance  for  the 
protection  of  employees  and  customers;  fire  insurance;  auto 
insurance;  workers'  compensation  insurance  to  cover  occupational 
hazards,  diseases,  and  injury;  glass  insurance;  burglary  and 
robbery  insurance;  crime  insurance;  personal  and  key  personnel 
insurance;  fidelity  bonds;  and  so  on."  Executives  have  to  be  both 
Jcnowledgeable  and  creative  when  determining  their  insurance  needs, 
and  when  dealing  with  the  insurers  themselves. 

Some  firms  also  accept  their  risks  and  self-insure,  using 
their  own  contingency  funds  when  the  need  arises."  Large  firms 
may  find  this  an  adequate  solution  for  part  of  their  insurance 
needs . 

Again,  just  obtaining  insurance  is  not  usually  the  sole 
solution  which  will  meet  a  firm's  economic  objectives  or  its  social 
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obligations.^  Insurance  coverage  is  valucUsle  only  to  a  business 
in  combination  with  a  conprehensive  disaster  plan. 


The  downtown  Chicago  flood,  California  earthquakes.  Hurricanes 
Andrew  and  Iniki,  and  so  on,  all  contributed  to  severe  losses  in 
the  insurance  industry,  and  included  losses  due  to  claims  from 
business  and  industry.  Numerous  insurers  went  under,  causing  the 
largest  insurance  failure  in  history.^’  The  point  is  simply  that 
there  are  no  guarantees  that  the  insurance  coverage  your  firms  has 
purchased  will  be  availcdale  for  claims  in  the  event  of  a  major 
catastrophic  disaster  or  series  of  disasters  similar  to  those  of 
1992.  Even  the  famous  Lloyd's  of  London  has  been  experiencing 
difficulties  and  losses- -since  Hurricane  Hugo  and  the  Exxon  Valdez 
oil  spill. 

WHAT  ABOUT  CONSULTANTS  AND  DISASTER  RECOVERY  SERVICE  COMPANIES 

During  the  past  10  years,  three  of  every  five  counties  in  the 
U.S.  have  experienced  a  disaster  serious  enough  to  warrant  a 
Presidential  Disaster  Declaration,  and  disasters  are  considerably 
more  costly  now,  as  well  as  more  frequent. 

More  and  more  executives  are  recognizing  the  risks  to  their 
firms  from  natural  disasters  and  man-made  disasters.  In  addition 
to  increased  awareness  through  media  coverage,  business  consultants 
and  associations  are  beginning  to  espouse  the  importance  of 
disaster  recovery  and  business  resumption  planning.  Hundreds  of 
disaster  recovery  consulting  firms  and  service  companies  also  now 
advertise  in  numerous  professional  journals,  magazines,  and 


newspapers .  Excunples  include  advertisements  in  Computer  Declsiona. 

InfQSygtemg,  Buginegg _ WesK.  computerworld.  Management 

Review.  Wall  Street  Journal,  and  so  on.  In  addition,  there  have 
been  a  growing  number  of  articles  regarding  the  merits  of  planning, 
and  examples  of  companies  which  planned  successfully,  either  on 
their  own  or  with  outside  assistance. 

The  market  for  disaster  recovery  services  is  growing  rapidly 
in  the  U.S.  and  it  is  estimated  that  total  annual  revenues  of  firms 
that  provide  these  services  will  exceed  one  billion  dollars  by 
1995.^  There  are  already  many  firms  in  the  disaster  recovery 
field  which  offer  various  products  and  services,  including  risk 
analysis,  data  processing  recovery  services,  total  business 
resumption  planning  assistance,  safety  and  security  services, 
backup  data  processing  sites  (hot,  cold) ,  educational  forums, 
telecommunications  recovery,  disaster  conferences,  off -site  records 
storage,  disaster  planning  software,  electronic  vaulting,  etc. 

Disaster  recovery  planning  in  the  past  usually  centered  on 
data  processing;  however,  total  business  recovery  planning  is 
becoming  more  prevalent.  Disaster  recovery  planning  is  a  "total 
organizational  concern"  which  relates  to  survival  of  the  firm,  it 
is  not  just  a  data  processing  center  concern.  In  addition  to 
recovery  plans,  and  backup  arrangements  for  data  processing,  firms 
are  moving  into  planning  and  backup  for  communications  and  for 
total  organization  and  business  function  recovery. 

Executives  have  various  options  available  to  them.  Some  of 
the  choices  include  setting  up  their  own  planning  team,  with  only 
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limited  assistance  obtaineUsle  from  local,  state,  and  federal 
government  activities.  Some  companies  can  afford  a  conplete  office 
and  computer  backup  site,  but  a  more  reasonable  option  might  be  to 
contract  with  a  disaster  recovery  firm  for  a  computer  cold  or  hot 
site,  or  mutually  agree  to  share  facilities  with  a  cort^aradily 
equipped  competitor,  or  join  in  a  multiconpany  agreement  for 
resource  sharing.  Firms  may  also  simply  purchase  commercially 
available  standard  disaster  recovery  planning  software  packages  to 
plot  their  course,  or  hire  a  disaster  recovery  consultant  to  do 
everything  from  risk  analysis  to  recommending  and  arranging  for 
off -site  storage  of  records,  and  establishing  a  data  processing 
backup  site  facility.  The  variety  of  options  availcd^le  today  to 
counter  the  risks  are  many.  The  ultimate  decision  though,  rests 
with  company  management,  and  senior  executive  commitment  is 
absolutely  essential. 

There  are  many  examples  of  businesses  and  industries  which 
have  utilized,  or  are  now  using  commercially  available  disaster 
recovery  plans,  services,  and/or  products.  These  include  Dennys, 
Inc.,  a  large  restaurant  chain;  Eli  Lilly  and  Company,  a 
pharmaceutical  conpany;  Charles  Schwab  and  Company,  an  investment 
firm;  Matson  Navigation  Company,  a  shipping  line;  utility 
companies;  and  financial  institutions.  The  data  is  not  availcible 
for  all  businesses  and  industries.  The  largest  firms  in  the 
disaster  recovery  business,  though,  are  Comdisco  Disaster  Recovery, 
with  1,550  clients  in  1989,  and  Sungard  Recovery  Services,  with  700 
clients  in  1989.^^ 


Natural  and  man-made  disasters  ranging  from  minor  to 
catastrophic  will  continue  to  plague  U.S.  business  and  Industry  in 
the  future.  The  economic  costs  and  loss  of  hxjman  lives  will  remain 
unacceptably  high  without  corrective  actions  on  the  part  of  both 
government,  and  business  and  industry. 

We  as  a  nation  have  been  slow  in  learning  our  lessons  in 
regard  to  disasters.  We  also  quickly  forget  the  lessons  we  do 
learn.  And  the  "it  can't  happen  to  me"  syndrome  afflicts  business 
and  industry,  as  well  as  individuals. 

Government 

The  rash  of  disasters  and  increased  media  attention  in  recent 
years  has  literally  forced  all  government  activities  to  improve 
their  disaster  preparedness  and  response.  Individuals  involved  in 
disasters  immediately  turn  to  government  for  assistance,  and  that 
help  is  being  provided  more  quickly  and  efficiently.  However,  U.S. 
business  and  industry  is  often  as  unprepared  as  individual 
citizens,  in  the  event  of  a  disaster.  But  unlike  individuals,  they 
can  expect  relatively  little  assistance  from  any  level  of 
goverrar.ent .  There  just  is  no  Executive,  Congressional,  or  pxablic 
outcry  for  business  and  industry  to  better  prepare  themselves  for 
disasters,  nor  any  educational  assistance  provided  for  business  and 
industry  executives. 


The  plight  of  business  and  industry  and  their  edsility  to 
survive  and  continue  operating  unheeded  is  directly  related  to  U.S. 


national  security.  Some  businesses  do  disaster  plamnlng,  and, 
there  are  hundreds  of  success  stories,  but  the  dismal  statistics  of 
business  losses  Indicates  more  needs  to  be  done. 

No  one  government  agency.  Including  FEMA,  sets  U.S.  policy  In 
regard  to  disaster  planning  for  business  and  Industry.  This  Is  a 
serious  and  costly  shortcoming - 

The  efficiency  of  the  market  has  always  been  the  overriding 
principle  for  U.S.  business  and  Industry.  In  a  market  economy. 
Individual  firms  are  responsible  for  taking  preventative  and 
cor-ective  action.  But  this  "hemds  off"  approach  is  proving  too 
slow,  and  will  only  ensure  a  continued  haphazard  commitment  to 
disaster  planning. 

FEMA  must  fill  the  policy  void  and  assume  responsibility  for 
U.S.  business  and  industry.  Each  federal  agency  will  continue  to 
regulate,  or  Ignore,  business  and  Industry,  In  regard  to  disaster 
planning,  without  FEMA's  leadership.  In  fact,  without  overall 
policy  guidance,  local,  state,  and  other  federal  government 
agencies  will  continue  to  regulate  as  each  sees  fit.  As  an 
excimple,  due  to  the  failure  of  business  and  industry  to  plan  to 
protect  lives  and  properly  handle  hazardous  materials  and  wastes, 
governments  have  begun  tightening  environmental  and  safety 
regulations.  But,  are  they  over- regulating  and  unnecessarily 
penalizing  firms?  Regulation  has  proven  inadequate  in  the  past, 
and  is  guaranteed  to  remain  that  way  without  FEMA's  leadership. 
Individual  firms  do  not  see  the  connection  to  national  security, 
but  senior  government  executives  should. 


The  evidence  presented  in  this  paper  certainly  suggests 
business  and  industry  should  prepare  for  disasters,  and  that 
government  leadership  is  lacking.  The  following  recommendations 
are  presented  as  critical  for  FEMA  to  adequately  address  the 
importance  of  business  and  industry  disaster  planning: 

First  Priority 

o  Assume  the  responsibility  for  providing  overall  policy 
guidance  to  all  government  activities  for  business  and 
industry. 

o  EsteJolish  dialogue  with  business  and  industry  in  order 
to  meet  their  specific  needs. 

o  EstcUolish  communications  with,  and  provide,  policy 
guidance  to  state  and  local  governments, 
o  Expand  the  pviblication  of  guides  for  business  and 
industry  disaster  planning,  and  improve  distribution, 
o  Provide  detailed  information  to  state  and  local 
governments  regarding  the  threats  in  their  area  and 
encourage  its  dissemination  to  business  and  industry, 
o  Ensure  that  the  nuclear,  chemical,  utility  and  finan¬ 
cial  industries  which  are  regulated  and  need  to  be 
regulated,  are  required  to  have  comprehensive  total 
organization  disaster  recovery  and  business  resump¬ 
tion  plans,  which  are  regularly  updated,  tested  and 
audited. 


o  Consider  tax  incentives  to  promote  disaster 
planning . 


Second  Priority 

o  Encourage  dialogue  and  cooperation  among  businesses 
to  better  plan  and  share  resources. 

o  Promote  cooperation  between  local  and  state  govern¬ 
ment  and  business  and  industry. 

o  Establish  training  courses  at  the  Emergency  Manage¬ 
ment  Institute  for  business  executives, 
o  Reinstitute  the  funding  for  state  and  local  govern¬ 
ments  to  conduct  business  and  industry  conferences 
and  training. 

o  Ensure  business  and  industry  are  included  in  national 
emergency  preparedness  exercises  and  tests,  and  encour¬ 
age  it  at  the  state  and  local  levels. 

o  Provide  financial  assistance  and  loans  (SBA)  to  firms 
with  the  condition  they  develop  and  maintain  a  disaster 
recovery  plan. 

o  Establish  a  communication  link  with  the  insurance  in¬ 
dustry  to  assist  and  assess  their  ability  to  meet  the 
needs  of  business  and  industry. 

Business  and  Industry 

Ultimately,  the  decision  to  plan  rests  with  management.  No 
government  regulations,  dictating  disaster  planning  as  mandatory. 


22 


could  ever  ensure  the  conqprehensiveness ,  nor  effectiveness  of 
individual  plans.  In  general,  the  government  must  make  an  effort 
to  assist  and  educate  business  and  industry  in  regard  to  disaster 
planning,  but  it  requires  the  management  of  individual  firms  to 
have  the  desire  to  listen  and  learn.  Business  and  industry  should 
consider  the  following  recommendations  and  conclusions.  Business 
and  industry; 

o  Shares  a  responsibility  with  government  in  disaster 
planning  and  preparedness. 

o  Directly  benefits  from  estcdslishing  a  dialogue  with  the 
government  and  the  community  in  that  they  are  better  pre¬ 
pared  to  deal  with  a  crisis. 

o  Must  plan  to  survive,  and  to  protect  their  most  valuable 
assets- -their  workers. 

o  Must  display  by  their  actions  a  dedication  and  concern 
for  the  pxiblic,  their  customers,  and  the  environment, 
o  Should  have  a  written  policy  regarding  the  importance 
of  a  comprehensive  disaster  plan  because  of  their  respon¬ 
sibilities  to  employee  health  and  safety,  continued  pro¬ 
fitability  and  survival,  to  protect  the  enviroiunent,etc. 
o  Should  take  advantage  of  information  and  assistance 
provided  by  their  associations  in  regard  to  disaster 
planning . 

o  Must  perform  risk  management  assessments  as  a  first 
step  in  disaster  planning. 

o  Owe  it  to  their  firm  and  their  customers,  in  most  cases. 


to  avail  themselves  of  expert  consultants  and  contract  for 
commercial  disaster  planning  products  and  services, 
o  Should  realize  that  their  management  inaction  in  regard 
to  disaster  planning  will  be  countered  by  government 
action  and  regulation  in  light  of  the  increasing  severity 
and  occurrences  of  disasters. 

o  Must  realize  that  it  takes  top  executive  commitment  to 
disaster  planning  to  ensure  success. 

o  Must  understand  that  disaster  recovery  planning  is  a 
total  organizational  concern,  and  not  just  a  data  pro¬ 
cessing  center  interest. 

o  Should  take  a  close  look  at  the  types  of  insurance 
coverage  available  for  their  firms,  and  assess  its 
adequacy  in  conjunction  with  a  comprehensive  disaster 
recovery  plan. 

o  Should  work  cooperatively  with  other  firms,  including 
competitors,  to  share  resources  in  planning  for  disasters, 
and  in  the  recovery  stage. 

o  Must  put  less  emphasis  on  adversarial  and  legalistic 
agreements  in  order  to  foster  cooperation  among  firms. 

FINAL  CCaOtEMTS 

On  Friday,  26  February  1993,  New  York  City's  Twin  Towers  of 
the  World  Trade  Center,  shook  from  top  to  bottom  as  a  huge  bomb 
blast  ripped  through  the  structure.  Since  that  day,  the  newspapers 
have  been  filled  with  stories  about  the  cause  of  the  blast,  the 
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numbers  killed  and  injured,  and  law  enforcement's  attempts  to  bring 
the  perpetrators  to  justice.  But  just  as  expected,  there  was  scant 
coverage  of  the  blast's  effects  on  the  businesses  housed  in  the 
World  Trade  Center. 

Nor  was  there  a  government  or  public  outcry  that  businesses 
should  have  been  prepared  for  survival  and  to  continue  operations 
in  spite  of  a  disaster  of  such  magnitude.  And  just  as  in  the  past, 
the  bombing  will  probably  be  soon  forgotten  by  most  Americans  -  - 
except  those  who  lost  businesses,  jobs,  and  loved  ones  or 
associates. 

There  is  hope  though  that  this  disaster,  one  in  a  long  string 
of  natural  and  man-made  disasters,  will  capture  the  attention  at 
least  of  some  of  America's  business  and  industry  executives,  and 
lead  them  to  action.  There  is  also  a  chance  --a  slim  one  though  -- 
that  the  Executive  and  Congressional  Branches  of  our  government 
will  take  note  and  recognize  the  costs  in  lives  and  dollars  to  our 
nation  when  businesses  and  industry  are  unprepared. 

More  specifically,  the  blast  caused  at  least  five  people  to 
die,  over  a  thousand  were  hurt,  euid  estimates  of  direct  damage  and 
lost  profits  exceed  one  billion  dollars.^  In  addition  to  both 
temporary  and  permanent  job  losses,  countless  customers  and  clients 
were  negatively  affected,  and  as  could  be  anticipated,  there  were 
both  failures  and  success  stories.  Many  companies  could  not 
quickly  get  access  to  their  offices,  computers,  and  files,  nor  even 
find  office  space  to  continue  operations.  Most  banks  and 
brokerages  were  reported  to  have  adjusted  without  interruption,  but 


the  Bond  House  Cantor  Fitzgerald  could  only  establish  a  temporary 
headquarters  with  most  employees  left  at  home.  And  the  law  firm  of 
Thatcher  Proffitt  &  Wood  lost  almost  two  hundred  thousand  dollars 
on  just  the  day  of  the  blast. 

On  the  positive  side.  New  York's  14  telecommunications 
carriers  who  are  usually  strong  competitors,  activated  a  previously 
agreed  upon  mutual  aid  agreement  which  allowed  them  to  stay  in 
contact  and  share  each  others'  equipment  and  phone  circuits.**  In 
regard  to  the  large  banks  and  exchanges,  most  did  not  lose  any  data 
despite  some  interruptions,  and  were  able  to  resume  operations  on 
Monday.*’ 

Demand  for  disaster  recovery  services  was  also  high.  The  Bank 
of  California  and  two  Japanese  banks  utilized  the  Comdisco  Disaster 
Recovery  Services'  large  computer  backup  facility  in  North  Bergan, 
New  Jersey.  Sungard  Recovery  Services  had  five  customers  declare 
a  disaster  to  obtain  assistance,  and  the  Newport  Financial  Center 
in  Jersey  City,  New  Jersey,  had  two  clients  set  up  backup  data 
centers.^ 

Again,  the  corporate  losses  in  just  this  one  major  disaster 
will  exceed  one  billion  dollars.  Wouldn't  it  be  worth  the  much 
smaller  investment  now  on  the  part  of  both  government  and  business 
and  industry  to  ensure  all  firms  are  prepared  to  face  disaster  in 
the  future? 
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